ShinyHunters exploit PeopleSoft RCE flaw
An unauthenticated RCE in Oracle PeopleSoft PeopleTools is being exploited by the ShinyHunters extortion gang to steal data from over 100 organizations.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-35273 as exploited in the wild.
CISA/MS-ISAC issued an advisory for CVE-2026-35273, a vulnerability in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.62). The flaw allows an unauthenticated attacker with network access via HTTP to achieve remote code execution and fully compromise the underlying system, requiring no user interaction, which makes internet-facing PeopleSoft deployments particularly at risk.
According to reporting cited from Bleeping Computer, the ShinyHunters extortion group is actively exploiting this vulnerability in ongoing data theft campaigns, claiming to have stolen data from over 100 organizations. PeopleSoft is widely deployed by large enterprises, government agencies, and universities for HR, payroll, finance, supply chain, and campus operations, making this a broad-impact target given its role managing sensitive business and personal data.
The advisory recommends immediate patching, vulnerability scanning, network segmentation, least-privilege enforcement, and exploit protection to mitigate risk. Organizations running affected PeopleTools versions should treat this as an urgent patching priority given confirmed active exploitation and data theft.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by PeopleSoft/WebLogic Application Server
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects cmd/powershell/shell processes spawned by Java-based PeopleSoft (Tuxedo/WebLogic) application server processes, indicative of RCE exploitation such as CVE-2026-35273. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from PeopleSoft Application Server
id: 6fa8c4a6-9c02-5e14-a2c1-0ea02673c40a
status: experimental
description: Detects command shell or scripting engine processes spawned by java.exe
or PeopleSoft/Tuxedo application server binaries (PSAPPSRV, PSAESRV, PSSAMSRV, weblogic),
which is consistent with post-exploitation command execution following remote code
execution against PeopleSoft PeopleTools (e.g. CVE-2026-35273).
references:
- https://www.bleepingcomputer.com/
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
parent_selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \PSAPPSRV.exe
- \PSAESRV.exe
- \PSSAMSRV.exe
- \PSQCKSRV.exe
- \PSTUXWIN.exe
child_selection:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \rundll32.exe
- \mshta.exe
- \certutil.exe
filter_admin:
CommandLine|contains:
- psadmin
- PSADMIN
condition: parent_selection and child_selection and not filter_admin
falsepositives:
- Legitimate PeopleSoft administration scripts invoked via psadmin utilities
- Scheduled maintenance jobs that call scripting engines from the application server
account
level: high
Webshell File Dropped in PeopleSoft/WebLogic Web Application Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of JSP/JSPX/WAR files in typical WebLogic/PeopleSoft deployment or servlet temp directories, a common post-exploitation step after RCE against PeopleSoft PeopleTools. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: JSP Webshell Dropped in WebLogic PeopleSoft Deployment Directory
id: dad9a4e2-a856-508e-8e06-bd6bb19ac8d8
status: experimental
description: Detects the creation of .jsp, .jspx, or .war files within WebLogic/PeopleSoft
managed server deployment, staging, or servlet temp directories. This behaviour
is commonly observed after successful exploitation of unauthenticated RCE flaws
such as CVE-2026-35273 in Oracle PeopleSoft PeopleTools, where attackers drop a
webshell to maintain access.
references:
- https://www.bleepingcomputer.com/
author: Vorant
tags:
- attack.t1190
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \servers\
- \stage\
- \tmp\_WL_
- \applications\
- \webapps\
TargetFilename|endswith:
- .jsp
- .jspx
- .war
filter_deploy:
TargetFilename|contains:
- \autodeploy\
condition: selection and not filter_deploy
falsepositives:
- Legitimate application deployment or redeployment of .war/.jsp artefacts by administrators
- CI/CD pipelines pushing updated PeopleSoft customizations to the application server
level: high
HTTP Requests to PeopleSoft Updates Environment Management Endpoint with Exploit Indicators
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the PeopleSoft PeopleTools Updates Environment Management component containing anomalous payload characteristics consistent with unauthenticated RCE exploitation attempts (CVE-2026-35273). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Anomalous Request to PeopleSoft Updates Environment Management Component
id: d3dbed48-1c00-57f1-89f4-e976f15efed4
status: experimental
description: Detects HTTP requests to PeopleSoft PeopleTools Updates Environment Management
URIs that include serialization, command, or scriptlet-like payload markers in the
request body or query string, indicative of exploitation attempts against CVE-2026-35273.
references:
- https://www.bleepingcomputer.com/
author: Vorant
tags:
- attack.t1190
- attack.initial-access
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains:
- UpdatesEnvironmentManagement
- EnvironmentManagement
selection_payload:
cs-uri-query|contains:
- ProcessBuilder
- Runtime
- getRuntime
- bash -c
- cmd.exe /c
- <%
condition: selection_uri and selection_payload
falsepositives:
- Vulnerability scanning or authorized penetration testing against the PeopleSoft
environment
- Automated security research tooling probing the Updates Environment Management endpoint
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-oracle-peoplesoft-peopletools-could-allow-for-remote-code-execution_2026-059
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs